Muhammad K.

DID YOU GET BSOD TOO? #CROWDSTRIKE It's not just you! Laptop blue screen errors.. Due to a recent end point protection update by Crowdstrike, a number of laptops are suffering a bluescreen of death error and are unable to successfully reboot. This issue has impacted a significant number of organisations within Australia. Crowdstrike is currently investigating the issue as a top priority. Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally.

9

Cyber Security Threats to the Australian Education Sector: Insights from Penetration Testing (2022-2024) The document highlights the significant cybersecurity vulnerabilities faced by the Australian education sector due to rapid digital transformation and reliance on cloud services. ​ Key findings from penetration tests conducted between 2022 and 2024 reveal critical weaknesses in internal networks, external applications, and cloud infrastructures, exposing institutions to data breaches, operational disruptions, financial losses, and reputational damage. Key Findings: * Internal Vulnerabilities: - Outdated protocols and weak security practices. - Use of end-of-life operating systems like Windows Server 2012. - Lack of LDAP signing, making systems vulnerable to man-in-the-middle attacks. * External Vulnerabilities: - Weak password management on external portals. - Use of outdated web components and libraries. - Directory indexing enabled, exposing sensitive information. - Weak SSL/TLS protocols and missing security headers. * Cloud Vulnerabilities: - Weak password management and lack of Multi-Factor Authentication (MFA). - Missing conditional access policies. - Unmanaged accounts and devices. - Excessive user permissions. Source: https://lnkd.in/g7b-Xqmi Company: Spartans Sec - https://lnkd.in/gqatya9t #SpartansSec #CyberSecurity #EducationSector #DataProtection #MFA #CloudSecurity #PenetrationTesting

14

1 Comment

📢 Exciting Announcement! 🔒 Seminar on Information Security Standards and Operations 🏫 Venue: Whitecliffe Wellington Campus - (Level-3 Ranchhode Tower, Lambton Quay Wellington, New Zealand) 📅 Date: 11-05-2024 (Saturday) 🕥 Time: 10:30 AM Join me for a comprehensive seminar delving into the realms of Information Security Standards and Operations. We'll explore the various phases of planning, designing, and implementing cyber defense policies tailored specifically for financial organizations. In this era of #AI & #cyberSecurity understanding both internal and external threats is paramount. Let's navigate through strategies to safeguard our organizations effectively. Looking forward to engaging discussions and valuable insights! #Standards #Policies #Assurance #Compliance #Governance #RiskAssessment #RiskManagement #Defense #CyberFrameWork #Ransom

40

8 Comments

Australian Information Security Association (AISA) #CyberCon2024 is approaching fast and I am excited to join an incredible lineup of distinguished security professionals and experts on variety of topics. Here are some sessions I’m particularly looking forward to: 1. Is security by design now the governance standard expected for company directors?, by Tony Vizza. 2. Cyber security meets Project Management: Why cyber risk management is achievable through better collaboration between the cyber security team and project managers, by Tony Vizza. 3. Building a Cyber Secure Future for Critical Infrastructure: Leveraging public-private collaboration to enhance cybersecurity resilience by, Darren Kane. 4. Generative AI powered information warfare: How to customize highly nuanced but convincing misinformation and disinformation, and how to mitigate them by, Dr. Tim McIntosh, CISSP, CIPP/E, PhD. 5. +Many more!

44

7 Comments

Vanessa gets right to the heart of why ITIL is a Cyber super power helping build knowledge of your infrastructure, knowing what has changed, detecting and responding to Incidents and recovering what matters. Thanks for sharing with the AISA Perth chapter Prashant!

8

1 Comment

Threat actor group #Handala has claimed responsibility for an alleged 51 TB of data being dumped and wiped, with some emails also being sent out from #Zerto, a Hewlett Packard Enterprise company. Zerto is known for its robust data management and protection solutions, trusted by over 9,500 customers globally and integrated with major cloud platforms such as Microsoft Azure, AWS, Google Cloud, and more. 👾 This incident underscores the persistent and evolving nature of cyber threats facing even the most well-established and secure companies. Key Points: 👾 Scope: 51 TB of data compromised 👾 Company: Zerto, a subsidiary of Hewlett Packard Enterprise 👾 Services Affected: #DataProtection, #recovery, and mobility services 👾 Implications: Potential disruptions for clients utilising Zerto's services for disaster recovery and data mobility.... Let's use this incident as a reminder of the ever-present need for robust security postures - not just framework compliance, and regular audits to ensure our systems are as resilient as possible against such threats. Greatest sympathies are with Zerto and those having to deal with the associated implications of this. #SecurityBreach #BreachRadar #CyberChatter

10

4 Comments

Big news for the Australia cybersecurity landscape! The Australian Cybersecurity Bill 2024 has been passed on 25th Nov 2024, bringing in some significant changes: 1.      Mandatory Cybersecurity Standards for Smart Devices: Say goodbye to the Wild West of IoT security. Manufacturers and suppliers will need to ensure that devices meet specific security standards before hitting the shelves. 2.      Ransomware Reporting: Certain businesses will be required to report ransomware payments to help authorities better understand the threat landscape. 3.      Enhanced Information Sharing: The Act facilitates faster and more open sharing of information between the National Cyber Security Coordinator (#NCSC), the Australian Signals Directorate (#ASD), and relevant entities during cyber incidents. 4.      Cyber Incident Review Board (#CIRB): This independent body will conduct no-fault post-incident reviews of significant cyber incidents to identify lessons and improve future response. This comprehensive legislation aims to bolster Australia's cybersecurity posture and protect businesses and individuals alike. Stay tuned for more updates on how this Act will shape the future of cybersecurity in Australia. #Cybersecurity #Australia #CybersecurityAct #CybersecurityBill https://lnkd.in/gFS3HF8V

74

3 Comments

The Australian Federal Police (AFP) is going into the cloud 🚀 🚫 Current Challenges: Handling large, malware-infested datasets often requires physically retrieving servers due to limited network capabilities. ✅ Infrastructure Upgrade: The AFP is implementing software-defined wide area networking (SD-WAN) to improve secure connectivity and manage network traffic more effectively. ⛅ Cloud Migration: Moving services to the cloud offers flexibility, resilience, and redundancy, enabling data to be accessed and analysed where experts are located rather than moving personnel to data sites. 🔐 SASE Implementation: Secure access service edge (SASE) technology will provide global security for devices, enhancing the resilience and flexibility of AFP operations. These upgrades aim to improve the AFP’s operational efficiency, security, and adaptability in combating cybercrime globally.

17

🚨 Cybersecurity Alert: State-Sponsored Attacks in Asia-Pacific 🌏 The Asia-Pacific region has become a hotbed for state-sponsored cyberattacks, with significant implications for global security and business. Key takeaways: • Increased frequency and sophistication of attacks targeting critical infrastructure, commercial enterprises, and government entities[1]. • Recent examples include attacks on Taiwanese organizations, North Korean cyber operations, and a vast IoT botnet discovered in September 2024[1]. • These attacks have severe economic and political consequences, affecting trade, investment, and regional stability. For US professionals and businesses: 1. Enhance your cybersecurity measures, focusing on protecting critical data and systems. 2. Stay informed about evolving cyber threats and tactics. 3. Collaborate with industry partners and government agencies to share threat intelligence. 4. Invest in employee training to recognize and respond to potential cyber threats. 5. Consider the geopolitical implications when expanding operations in the Asia-Pacific region. Let's work together to build a more secure digital future. What steps is your organization taking to protect against state-sponsored cyber threats? Share your thoughts below! 👇 #Cybersecurity #AsiaPacific #TechSecurity #BusinessRisk

2

Australia is the no.10 most targeted country for phishing attacks A new report from Zscaler sheds light on a rising number of #phishing attacks and the huge surge in attacks aimed at and hosted by Australia. According to the statistics, Australia is the tenth-most targeted nation in the world when it comes to phishing. However, Australia ranks second in the Asia-Pacific and Japan region, with 29,427,987 attacks, behind only India. In fact, over 12 per cent of all #attacks in the region target Australians or Australian entities, but it’s not just incoming attacks that are on the up. Talenza Cyberdaily: The Cybersecurity Daily News David Hollingworth #cyber #itsecurity #infosec #cyberattacks #cyberthreats #australia #apac

23

3 Comments

ACCC bolsters its #cybersecurity as it becomes Australia’s Digital ID regulator To deal with the increased security workloads following the establishment of the National Anti-Scam Centre and the launch of #DigitalID, the Australian Competition and Consumer Commission (ACCC) has launched a new program to bolster its cyber security. “The ACCC’s #cyber #security uplift program is focused on #compliance and maturity uplift against the ASD’s #Essential8 and Protective Security Policy Framework primarily,”. “The program is ongoing. One primary reason for the posting is the increased cyber security workload with the recent inclusion of the Digital Identity regulatory role and the National Anti-#Scam Centre being established in the ACCC". #infosec Talenza The Transformation Group

4

How many out there know that there is an Australian government approved cyber security framework and certification? No, it's not Essential 8. Although Essential 8 is the "go to" framework from the ACSC, that's not what I'm referring to. SMB1001 has been brought to market by Cyber Security Certification Australia (CSCAU) and is available now for any organisation to certify themselves against. 5 tiers, to cater from small business to larger organisations well into the mid-market space. MyCISO and CyberCert have partnered up to bring the SMB1001 framework into our Assess platform to provide a really great way for those organisations who don't want to go down the ISO 27001 or full NIST CSF path to baseline their maturity, and be able to prove to their customers that they have taken reasonable steps to secure thier cyber posture. This same framework can be used as an excellent baseline to assess your supply chain as well. Fewer control requirements, but focused on the things you really need to know when assessing risk in your 3rd parties. Reach out to us here at MyCISO, or get in touch with Cyber Security Certification Australia (CSCAU) if you want to learn more. Stay safe out there! #cybersecurity #smb1001 Dane Meah Nick Anderson Ryan Ko Peter Maynard

68

6 Comments

Supporting Career Villages at Conferences in 2024! I am organising multiple career villages at conferences in Australia, BSides Canberra, BSides Melbourne, and Australian Information Security Association (AISA) CyberCon (Melbourne) this year. I am looking for industry professionals who want to share their knowledge, experience, and advice with others. Ideas for talks: 👉 Breaking down what you do in your job. 👉 Share your unusual journey into the industry. (help inspire others) 👉 Hiring managers advising on what you look out for when hiring. 👉 CISO sharing advice for aspiring CISOs. I am looking for people to join in on some panel sessions: 👉 Certifications 👉 Neurodiversity in cybersecurity 👉 Student to cybersecurity professional We will also seek volunteers to do resume reviews/ mock interviews. There are formal CFPs for BSides Canberra and BSides Melbourne, which you will need to complete, but if you're interested in helping out and don't know where to start/ want to register your interest, fill out the Google Form in the comments, and I can work with you on your submission. We haven't seen much in the way of gender diversity in submissions so far. It sounds corny, but be the change you want to see.

82

13 Comments

MOAT: Securely Mitigating Rowhammer with Per-Row Activation Counters The security vulnerabilities due to Rowhammer have worsened over the last decade, with existing in-#DRAM solutions, such as TRR, getting broken with simple patterns. In response, the #DDR5 specifications have been extended to support #Per-#Row #Activation #Counting (#PRAC), with counters inlined with each row, and #ALERT-#Back-#Off (#ABO) to stop the memory controller if the DRAM needs more time to mitigate. Although PRAC+ABO represents a strong advance in #Rowhammer #protection, they are just a framework, and the actual security is dependent on the implementation. In this paper, we first show that a prior work, #Panopticon (which formed the basis for PRAC+ABO), is insecure, as our #Jailbreak pattern can cause 1150 activations on an attack row for Panopticon configured for a threshold of 128. We then propose MOAT, a provably secure design, which uses two internal thresholds: #ETH, an Eligibility Threshold for mitigating a row, and ATH, an ALERT Threshold for initiating an ABO. As JEDEC specifications permit a few activations between consecutive ALERTs, we also study how an #attacker can #exploit such activations to inflict more activations than ATH on an attack row and thus increase the tolerated Rowhammer threshold. Our analysis shows that MOAT configured with ATH=64 can safely tolerate a Rowhammer threshold of 99. Finally, we also study performance attacks and #denial of-#service due to ALERTs. Our evaluations, with #SPEC and #GAP workloads, show that MOAT with ATH=64 incurs an average slowdown of 0.28% and 7 bytes of SRAM per bank. Centro de Investigación de Ciberseguridad IoT - IIoT

13

🚨MUST READ 🚨: The Australian Signals Directorate has released exceptional content on system hardening for Active Directory. This guidance informs organisations on 17 common techniques used by threat actors to target Active Directory, informed by intelligence services in the Five Eyes. Time and time again, I've personally exploited the same issues outlined in this article to privilege escalate and laterally move within an organisation, to achieve full domain compromise. If the industry followed this advice, it would be hardened against majority of the cyber threats including ransomware and cyber crime. Read now: https://lnkd.in/gExkK2wa

108

2 Comments